Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

DoS via Unbounded Loop in enterRaffle - Quadratic Gas Consumption

leoyeesir

Root + Impact

jioqweqwe

Description

The enterRaffle function allows users to participate in the raffle by submitting an array of player addresses. The contract must ensure no duplicate addresses exist in the players array to maintain fair participation.

The function implements duplicate checking using a nested loop algorithm that compares each new player against all existing players. This creates O(n²) time complexity where n represents the current number of participants.

for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

Risk

Likelihood:

  • The gas cost grows quadratically as more players enter the raffle, inevitably exceeding the block gas limit once ~300-400 players have joined

  • Each additional player requires iterating through all existing players, making the function progressively more expensive to call

Impact:

  • Complete denial of service - no new participants can enter the raffle once the gas limit is reached

  • Existing participants' funds become trapped in the contract as the raffle cannot accept new entries to reach a winner selection threshold

  • Protocol becomes permanently unusable without contract migration

Proof of Concept

Empirical gas measurements confirm quadratic complexity in enterRaffle:

At 40 players, adding one more participant already consumes 730k gas. Extrapolating the O(n²) trend, with 300 players the operation would require >30M gas—exceeding the Ethereum block gas limit and permanently bricking the contract. The test consumed 23.3M gas total, demonstrating imminent DoS at scale.

// Single player addition gas costs:
10 existing players: 82,097 gas
20 existing players: 214,607 gas (2.6x increase)
30 existing players: 430,517 gas (5.2x increase)
40 existing players: 729,827 gas (8.9x increase)
function testEnterRaffleGasDoS() public {
// Track gas consumption for different player counts
uint256[] memory playerCounts = new uint256[](4);
playerCounts[0] = 10;
playerCounts[1] = 20;
playerCounts[2] = 30;
playerCounts[3] = 40;
​
for (uint256 i = 0; i < playerCounts.length; i++) {
// Create a fresh contract instance for each test
PuppyRaffle freshRaffle = new PuppyRaffle(
entranceFee,
feeAddress,
duration
);
​
// First, add some initial players to establish baseline
address[] memory initialPlayers = new address[](playerCounts[i]);
for (uint256 j = 0; j < playerCounts[i]; j++) {
initialPlayers[j] = address(uint160(j + 100)); // Unique addresses
}
​
uint256 gasBefore = gasleft();
freshRaffle.enterRaffle{value: entranceFee * playerCounts[i]}(
initialPlayers
);
// uint256 gasUsedFirstBatch = gasBefore - gasleft();
​
// Now add one more player - gas cost should be O(n^2) where n is total players
address[] memory oneMorePlayer = new address[](1);
oneMorePlayer[0] = address(uint160(playerCounts[i] + 100));
​
gasBefore = gasleft();
freshRaffle.enterRaffle{value: entranceFee}(oneMorePlayer);
uint256 gasUsedOneMore = gasBefore - gasleft();
​
// With O(n^2) algorithm, gas for adding 1 more player after n players is ~O(n)
// We'll output the gas usage to show the pattern
console.log("Players before adding one more:", playerCounts[i]);
console.log("Gas used for one more player:", gasUsedOneMore);
​
// Show quadratic growth: gas for 40 players should be ~4x gas for 20 players
// (40^2 ≈ 4 * 20^2)
if (i > 0) {
uint256 expectedRatio = (playerCounts[i] * playerCounts[i]) /
(playerCounts[i - 1] * playerCounts[i - 1]);
console.log("Expected quadratic growth ratio:", expectedRatio);
}
}

Recommended Mitigation

Replace the O(n²) duplicate check with a mapping for O(1) constant-time lookups. This eliminates the unbounded loop and ensures gas costs remain fixed regardless of participant count.

// Add state variable to track active participants
mapping(address => bool) public isActivePlayer;
​
function enterRaffle(address[] calldata newPlayers) external payable {
require(msg.value == entranceFee * newPlayers.length, "Incorrect ETH amount");
for (uint256 i = 0; i < newPlayers.length; i++) {
address player = newPlayers[i];
// O(1) duplicate check instead of O(n²) loop
require(!isActivePlayer[player], "PuppyRaffle: Duplicate player");
isActivePlayer[player] = true;
players.push(player);
}
emit RaffleEntered(newPlayers);
}
​
// Optional: Clean up mapping when player refunds or winner selected
function _removePlayer(address player) internal {
isActivePlayer[player] = false;
}
​
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 10 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!